Question 1

Which configuration file determines how a universal forwarder forwards data to the indexer?

Options :

A : transforms.conf

B : outputs.conf

C : inputs.conf

D : props.conf

Answer: B

Question 2

If a new event's raw data contains a timestamp, what is the next check (or decision) that Splunk makes in the event timestamp processing logic?

Options :

A : Check if explicit time extraction rules exist in props.conf.

B : Check if the event contains a date.

C : Check if the file name contains a date.

D : Check if timestamps of nearby events from the same source are within a ten minute offset.

Answer: A

Question 3

Which option can be used to specify the host value of the data when creating a file or directory monitor input?

Options :

A : Select Host

B : Define Host

C : Choose Host

D : Set Host

Answer: D

Question 4

What is the name of the first step that you need to perform to configure the LDAP authentication scheme with Splunk Web?

Options :

A : Configure LDAP settings

B : Create an LDAP strategy

C : Map LDAP groups to Splunk roles

D : Test LDAP connection

Answer: B

Question 5

If events are not forwarded from the Forwarder to the Splunk cloud, which option is appropriate for troubleshooting?

Options :

A : Execute a ping from the Forwarder and check that the splunk cloud URL can be reached.

B : Check the Fowarder output.log to ensure that forwarding is being carried out properly.

C : Run the oneshot command and check if the event is reachable.

D : Check the _audit index and see if there are any events where the Forwarder is host.

Answer: C

Smartly Prepare Exam with Free Online SPLK-1005 Practice Test